修改icmp发包模式,更适合大规模探测。

修改报错提示,--debug时,如果10秒内没有LogSuccess的消息,每隔10秒就会打印一下当前进度

Plugins/ftp.go

@@ -16,6 +16,8 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 			if flag == true && err == nil {
 				return err
 			} else {
+				errlog := fmt.Sprintf("[-] ftp %v %v %v %v %v", info.Host, common.PORTList["ftp"], user, pass, err)
+				common.LogError(errlog)
 				tmperr = err
 			}
 		}

Plugins/icmp.go

@@ -3,6 +3,8 @@ package Plugins
 import (
 	"bytes"
 	"fmt"
+	"golang.org/x/net/icmp"
+	"log"
 	"net"
 	"os"
 	"os/exec"
@@ -50,58 +52,52 @@ func GetSys() SystemInfo {
 	return sysinfo
 }
 
-func isping(ip string) bool {
-	IcmpByte := []byte{8, 0, 247, 255, 0, 0, 0, 0}
-	Time, _ := time.ParseDuration("3s")
-	conn, err := net.DialTimeout("ip4:icmp", ip, Time)
+func IcmpCheck(hostslist []string) {
+	conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
+	endflag := false
 	if err != nil {
-		return false
-	}
-	defer conn.Close()
-	_, err = conn.Write(IcmpByte)
-	if err != nil {
-		return false
+		log.Fatal(err)
 	}
+	var chanHosts = make(chan string)
+	go func() {
+		for {
+			if endflag == true {
+				return
+			}
+			msg := make([]byte, 100)
+			_, sourceIP, _ := conn.ReadFrom(msg)
+			if sourceIP != nil {
+				chanHosts <- sourceIP.String()
+			}
+		}
+	}()
 
-	if err := conn.SetReadDeadline(time.Now().Add(time.Second * 3)); err != nil {
-		return false
-	}
+	go func() {
+		for ip := range chanHosts {
+			if !IsContain(AliveHosts, ip) {
+				fmt.Printf("(icmp) Target '%s' is alive\n", ip)
+				AliveHosts = append(AliveHosts, ip)
+			}
+		}
+	}()
 
-	recvBuf := make([]byte, 40)
-	num, err := conn.Read(recvBuf[0:40])
-	if err != nil {
-		return false
+	for _, host := range hostslist {
+		write(host, conn)
 	}
-	if err := conn.SetReadDeadline(time.Now().Add(time.Second * 3)); err != nil {
-		return false
+	if len(hostslist) > 10 {
+		time.Sleep(6 * time.Second)
+	} else {
+		time.Sleep(3 * time.Second)
 	}
-	if string(recvBuf[0:num]) != "" {
-		fmt.Printf("(ICMP) Target '%s' is alive\n", ip)
-		return true
-	}
-	return false
-
+	endflag = true
+	close(chanHosts)
+	conn.Close()
 }
 
-func IcmpCheck(hostslist []string, IcmpThreads int) {
-	var wg sync.WaitGroup
-	mutex := &sync.Mutex{}
-	limiter := make(chan struct{}, IcmpThreads)
-	for _, host := range hostslist {
-		wg.Add(1)
-		limiter <- struct{}{}
-		go func(host string) {
-			defer wg.Done()
-			if isping(host) {
-				mutex.Lock()
-				AliveHosts = append(AliveHosts, host)
-				mutex.Unlock()
-			}
-			<-limiter
-		}(host)
-
-	}
-	wg.Wait()
+func write(ip string, conn *icmp.PacketConn) {
+	dst, _ := net.ResolveIPAddr("ip", ip)
+	IcmpByte := []byte{8, 0, 247, 255, 0, 0, 0, 0}
+	conn.WriteTo(IcmpByte, dst)
 }
 
 func ExecCommandPing(ip string, bsenv string) bool {
@@ -133,7 +129,7 @@ func ExecCommandPing(ip string, bsenv string) bool {
 func PingCMDcheck(hostslist []string, bsenv string) {
 	var wg sync.WaitGroup
 	mutex := &sync.Mutex{}
-	limiter := make(chan struct{}, 40)
+	limiter := make(chan struct{}, 50)
 	for _, host := range hostslist {
 		wg.Add(1)
 		limiter <- struct{}{}
@@ -150,18 +146,17 @@ func PingCMDcheck(hostslist []string, bsenv string) {
 	}
 	wg.Wait()
 }
-func ICMPRun(hostslist []string, IcmpThreads int, Ping bool) []string {
-
+func ICMPRun(hostslist []string, Ping bool) []string {
 	if SysInfo.OS == "windows" {
 		if Ping == false {
-			IcmpCheck(hostslist, IcmpThreads)
+			IcmpCheck(hostslist)
 		} else {
 			PingCMDcheck(hostslist, "")
 		}
 	} else if SysInfo.OS == "linux" {
 		if SysInfo.Groupid == "0" || SysInfo.Userid == "0" || SysInfo.Username == "root" {
 			if Ping == false {
-				IcmpCheck(hostslist, IcmpThreads)
+				IcmpCheck(hostslist)
 			} else {
 				PingCMDcheck(hostslist, "/bin/bash")
 			}
@@ -173,7 +168,7 @@ func ICMPRun(hostslist []string, IcmpThreads int, Ping bool) []string {
 	} else if SysInfo.OS == "darwin" {
 		if SysInfo.Groupid == "0" || SysInfo.Userid == "0" || SysInfo.Username == "root" {
 			if Ping == false {
-				IcmpCheck(hostslist, IcmpThreads)
+				IcmpCheck(hostslist)
 			} else {
 				PingCMDcheck(hostslist, "/bin/bash")
 			}

Plugins/mssql.go

@@ -17,6 +17,8 @@ func MssqlScan(info *common.HostInfo) (tmperr error) {
 			if flag == true && err == nil {
 				return err
 			} else {
+				errlog := fmt.Sprintf("[-] mssql %v %v %v %v %v", info.Host, common.PORTList["mssql"], user, pass, err)
+				common.LogError(errlog)
 				tmperr = err
 			}
 		}

Plugins/mysql.go

@@ -17,6 +17,8 @@ func MysqlScan(info *common.HostInfo) (tmperr error) {
 			if flag == true && err == nil {
 				return err
 			} else {
+				errlog := fmt.Sprintf("[-] mysql %v %v %v %v %v", info.Host, common.PORTList["mysql"], user, pass, err)
+				common.LogError(errlog)
 				tmperr = err
 			}
 		}

Plugins/postgres.go

@@ -17,6 +17,8 @@ func PostgresScan(info *common.HostInfo) (tmperr error) {
 			if flag == true && err == nil {
 				return err
 			} else {
+				errlog := fmt.Sprintf("[-] psql %v %v %v %v %v", info.Host, common.PORTList["psql"], user, pass, err)
+				common.LogError(errlog)
 				tmperr = err
 			}
 		}

Plugins/redis.go

@@ -21,6 +21,8 @@ func RedisScan(info *common.HostInfo) (tmperr error) {
 		if flag == true && err == nil {
 			return err
 		} else {
+			errlog := fmt.Sprintf("[-] redis %v %v %v %v %v", info.Host, common.PORTList["redis"], pass, err)
+			common.LogError(errlog)
 			tmperr = err
 		}
 	}
@@ -47,7 +49,7 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 		result := fmt.Sprintf("[+] Redis:%s %s", realhost, pass)
 		common.LogSuccess(result)
 		flag = true
-		Expoilt(info, realhost, conn)
+		Expoilt(realhost, conn)
 	}
 	return flag, err
 }
@@ -72,12 +74,12 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 		result := fmt.Sprintf("[+] Redis:%s unauthorized", realhost)
 		common.LogSuccess(result)
 		flag = true
-		Expoilt(info, realhost, conn)
+		Expoilt(realhost, conn)
 	}
 	return flag, err
 }
 
-func Expoilt(info *common.HostInfo, realhost string, conn net.Conn) error {
+func Expoilt(realhost string, conn net.Conn) error {
 	flagSsh, flagCron, err := testwrite(conn)
 	if err != nil {
 		return err
@@ -85,8 +87,8 @@ func Expoilt(info *common.HostInfo, realhost string, conn net.Conn) error {
 	if flagSsh == true {
 		result := fmt.Sprintf("Redis:%v like can write /root/.ssh/", realhost)
 		common.LogSuccess(result)
-		if info.RedisFile != "" {
-			writeok, text, err := writekey(conn, info.RedisFile)
+		if common.RedisFile != "" {
+			writeok, text, err := writekey(conn, common.RedisFile)
 			if err != nil {
 				return err
 			}
@@ -102,8 +104,8 @@ func Expoilt(info *common.HostInfo, realhost string, conn net.Conn) error {
 	if flagCron == true {
 		result := fmt.Sprintf("Redis:%v like can write /var/spool/cron/", realhost)
 		common.LogSuccess(result)
-		if info.RedisShell != "" {
-			writeok, text, err := writecron(conn, info.RedisShell)
+		if common.RedisShell != "" {
+			writeok, text, err := writecron(conn, common.RedisShell)
 			if err != nil {
 				return err
 			}

Plugins/scanner.go

@@ -12,9 +12,9 @@ import (
 
 func Scan(info common.HostInfo) {
 	fmt.Println("scan start")
-	Hosts, _ := common.ParseIP(info.Host, info.HostFile)
-	if info.Isping == false {
-		Hosts = ICMPRun(Hosts, info.IcmpThreads, info.Ping)
+	Hosts, _ := common.ParseIP(info.Host, common.HostFile)
+	if common.IsPing == false {
+		Hosts = ICMPRun(Hosts, common.Ping)
 		fmt.Println("icmp alive hosts len is:", len(Hosts))
 	}
 	if info.Scantype == "icmp" {
@@ -28,7 +28,7 @@ func Scan(info common.HostInfo) {
 	for _, port := range common.PORTList {
 		severports = append(severports, strconv.Itoa(port))
 	}
-	var ch = make(chan struct{}, info.Threads)
+	var ch = make(chan struct{}, common.Threads)
 	var wg = sync.WaitGroup{}
 	for _, targetIP := range AlivePorts {
 		info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
@@ -55,12 +55,12 @@ func AddScan(scantype string, info common.HostInfo, ch chan struct{}, wg *sync.W
 	wg.Add(1)
 	go func() {
 		err, _ := ScanFunc(PluginList, scantype, &info)
-		if info.Debug {
+		if common.LogErr {
 			tmperr := err[0].Interface()
 			if tmperr != nil {
 				tmperr1 := err[0].Interface().(error)
 				errtext := strings.Replace(tmperr1.Error(), "\n", "", -1)
-				fmt.Println(info.Host+":"+info.Ports, errtext)
+				fmt.Println("[-] ", info.Host+":"+info.Ports, errtext)
 			}
 		}
 		wg.Done()

Plugins/smb.go

@@ -23,6 +23,8 @@ func SmbScan(info *common.HostInfo) (tmperr error) {
 				common.LogSuccess(result)
 				return err
 			} else {
+				errlog := fmt.Sprintf("[-] smb %v %v %v %v %v", info.Host, 445, user, pass, err)
+				common.LogError(errlog)
 				tmperr = err
 			}
 		}

Plugins/ssh.go

@@ -17,6 +17,8 @@ func SshScan(info *common.HostInfo) (tmperr error) {
 			if flag == true && err == nil {
 				return err
 			} else {
+				errlog := fmt.Sprintf("[-] ssh", info.Host, common.PORTList["ssh"], user, pass, err)
+				common.LogError(errlog)
 				tmperr = err
 			}
 		}

Plugins/webtitle.go

@@ -23,7 +23,7 @@ func WebTitle(info *common.HostInfo) (err error, result string) {
 	}
 
 	err, result = geturl(info)
-	if info.IsWebCan || err != nil {
+	if common.IsWebCan || err != nil {
 		return
 	}
 
@@ -44,9 +44,15 @@ func geturl(info *common.HostInfo) (err error, result string) {
 		TLSClientConfig:   &tls.Config{InsecureSkipVerify: true},
 		DisableKeepAlives: false,
 		DialContext: (&net.Dialer{
-			Timeout: time.Duration(info.WebTimeout) * time.Second,
+			Timeout:   time.Duration(info.WebTimeout) * time.Second,
+			KeepAlive: time.Duration(info.WebTimeout+3) * time.Second,
 		}).DialContext,
+		MaxIdleConns:        1000,
+		MaxIdleConnsPerHost: 1000,
+		IdleConnTimeout:     time.Duration(info.WebTimeout+3) * time.Second,
+		TLSHandshakeTimeout: 5 * time.Second,
 	}
+
 	var client = &http.Client{Timeout: time.Duration(info.WebTimeout) * time.Second, Transport: tr}
 	res, err := http.NewRequest("GET", url, nil)
 	if err == nil {